Opinion: EvilTokens shows AI speeding Microsoft 365 device-code phishing
Microsoft said it disrupted Storm-2992 in September after the service, found in February, used AI across the chain.
1
Stories per day · 30 days
2 RSS
Relateddevice-code2itdr1mfa1microsoft-3651oauth1passkeys1phishing1phishing-as-a-service1storm-29921webauthn1
13 stories, newest first · one card per story
Stories tagged #eviltokens
Passkeys Raise the Bar. Here’s Where Attackers Can Still Get In.
Huntress says the EvilTokens device-code phishing kit hit 344 organizations without breaking passkey cryptography.
Huntress Tragic Quadrant: Top Cyber Threats Wrecking Businesses
Huntress finds RMM abuse, mailbox-rule BEC, and AiTM token theft most often disrupt SMBs.
Phishing Response Protocol: 3 Essential SOC Steps Powered by ANY.RUN’s Latest Product Updates
ANY.RUN promotes three SOC steps for faster phishing response using new sandbox and reporting features.
Social Engineering in the Age of Synthetic Media
Recorded Future details how threat actors abuse jailbroken and legitimate AI tools to scale phishing, deepfake impersonation, and phishing-as-a-service operations.
19
⚡ Weekly Recap: $387M Crypto Hack, Citrix Exploits, AI Agents Go Off-Script, and More Threats
Weekly recap led by actively exploited Citrix NetScaler ADC/Gateway flaws CVE-2026-88771 and CVE-2026-88772, plus the $387M Bitget hack and EvilTokens takedown.
How device code phishing gives scammers access to your account
Device code phishing tricks users into approving a real OAuth sign-in, handing attackers account tokens.
3
Microsoft disrupts EvilTokens phishing service that gave criminals access to 12,000 inboxes
Microsoft and partners seized EvilTokens infrastructure after the phishing service compromised over 12,000 inboxes.
1
Microsoft’s EvilTokens takedown sheds light on state of AI-powered cybercrime
Microsoft seized EvilTokens infrastructure after the AI phishing service compromised about 12,000 Microsoft 365 inboxes.
1
Microsoft Disrupts EvilTokens Device Code Phishing Service
Microsoft seized 50 sites and disabled over 150 domains used by EvilTokens to phish Microsoft 365 accounts.
Microsoft disrupts AI-assisted platform that compromised 12,000
Microsoft seized EvilTokens, an AI-chatbot BEC platform that compromised 12,000 accounts across 10,000 organizations.
Microsoft Takes Down EvilTokens Device-Code Phishing Service Tied to 12,000 Inbox Compromises
Microsoft dismantled EvilTokens, an AI-assisted device-code phishing service linked to about 12,000 inbox takeovers.
1
UK Cops arrest 2 EvilTokens suspects, Microsoft seizes 50 phishing kit websites
UK police arrested two EvilTokens admins as Microsoft seized sites used to phish over 12,000 inboxes.
1